Repository navigation
[None][infra] Add a probe workflow for running Check Test List on Git… #21008
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
15c76a1
c9f8505
1eb72c5
790f0e7
cdfa563
a28a944
6e29088
01ca07f
819c1ee
a11e624
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,141 @@ | ||||||||||||||||
| # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | ||||||||||||||||
| # SPDX-License-Identifier: Apache-2.0 | ||||||||||||||||
| # | ||||||||||||||||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||||||||||||||||
| # you may not use this file except in compliance with the License. | ||||||||||||||||
| # You may obtain a copy of the License at | ||||||||||||||||
| # | ||||||||||||||||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||||||||||||||||
| # | ||||||||||||||||
| # Unless required by applicable law or agreed to in writing, software | ||||||||||||||||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||||||||||||||||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||||||||||||||||
| # See the License for the specific language governing permissions and | ||||||||||||||||
| # limitations under the License. | ||||||||||||||||
|
|
||||||||||||||||
| # Probe how long the Jenkins "Check Test List" stage takes on a GitHub-hosted | ||||||||||||||||
| # runner with CUDA torch, the full requirements-dev set and a pip cache. | ||||||||||||||||
| name: Check Test List Probe | ||||||||||||||||
| on: | ||||||||||||||||
| pull_request: | ||||||||||||||||
| paths: | ||||||||||||||||
| - '.github/workflows/check-test-list-probe.yml' | ||||||||||||||||
| workflow_dispatch: | ||||||||||||||||
|
|
||||||||||||||||
| concurrency: | ||||||||||||||||
| group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} | ||||||||||||||||
| cancel-in-progress: true | ||||||||||||||||
|
|
||||||||||||||||
| env: | ||||||||||||||||
| TORCH_VERSION: '2.14.0' | ||||||||||||||||
| TORCH_INDEX: https://download.pytorch.org/whl/cu132 | ||||||||||||||||
|
|
||||||||||||||||
| jobs: | ||||||||||||||||
| collect: | ||||||||||||||||
| name: Collect (full-cuda deps, ubuntu-latest) | ||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||
| timeout-minutes: 60 | ||||||||||||||||
| steps: | ||||||||||||||||
| # Same layout as the Jenkins stage: the source lives in a subdirectory and | ||||||||||||||||
| # check_test_list.py is invoked by absolute path from the workspace root. | ||||||||||||||||
| - uses: actions/checkout@v6 | ||||||||||||||||
| with: | ||||||||||||||||
| path: llm | ||||||||||||||||
|
Comment on lines
+41
to
+43
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔎 Supported by static analysis
Disable checkout credential persistence in the The collect step loads The earlier pip installation steps can execute third-party build code in the same job. That code can access the checkout token while credentials remain persisted. In checkout v6, the token is stored in the runner temporary directory and referenced through Git configuration; it is not stored directly as a token value in 🔒️ Proposed fix
Committable suggestion
🧰 Tools
|
||||||||||||||||
|
|
||||||||||||||||
| - uses: actions/setup-python@v6 | ||||||||||||||||
| id: python | ||||||||||||||||
| with: | ||||||||||||||||
| python-version: '3.12' | ||||||||||||||||
| cache: 'pip' | ||||||||||||||||
| cache-dependency-path: | | ||||||||||||||||
| llm/requirements.txt | ||||||||||||||||
| llm/requirements-dev.txt | ||||||||||||||||
| llm/constraints.txt | ||||||||||||||||
|
|
||||||||||||||||
| - name: Install torch | ||||||||||||||||
| run: | | ||||||||||||||||
| start=$SECONDS | ||||||||||||||||
| python -m pip install --upgrade pip | ||||||||||||||||
| python -m pip install --index-url "${TORCH_INDEX}" "torch==${TORCH_VERSION}" torchvision | ||||||||||||||||
| echo "TORCH_SECONDS=$((SECONDS - start))" >> "$GITHUB_ENV" | ||||||||||||||||
|
|
||||||||||||||||
| # mpi4py loads libmpi when mpi4py.MPI is imported. The CI image ships | ||||||||||||||||
| # HPC-X OpenMPI; on a plain runner the openmpi wheel provides it. | ||||||||||||||||
| - name: Install requirements | ||||||||||||||||
| working-directory: llm | ||||||||||||||||
| run: | | ||||||||||||||||
| printf 'torch==%s\n' "${TORCH_VERSION}" > "${RUNNER_TEMP}/torch-pin.txt" | ||||||||||||||||
| start=$SECONDS | ||||||||||||||||
| python -m pip install --extra-index-url "${TORCH_INDEX}" \ | ||||||||||||||||
| -c "${RUNNER_TEMP}/torch-pin.txt" -r requirements-dev.txt openmpi | ||||||||||||||||
| echo "REQ_SECONDS=$((SECONDS - start))" >> "$GITHUB_ENV" | ||||||||||||||||
|
|
||||||||||||||||
| # urm.nvidia.com does not resolve from GitHub-hosted runners. check_test_list | ||||||||||||||||
| # only runs `trt-test-db -d DIR --test-names --output FILE`, which lists every | ||||||||||||||||
| # test name in DIR/*.yml; this stand-in produces the same set from the YAML. | ||||||||||||||||
| - name: Install a trt-test-db stand-in | ||||||||||||||||
| run: | | ||||||||||||||||
| mkdir -p "${RUNNER_TEMP}/bin" | ||||||||||||||||
| cat > "${RUNNER_TEMP}/bin/trt-test-db" <<'EOF' | ||||||||||||||||
| #!/usr/bin/env python3 | ||||||||||||||||
| import argparse | ||||||||||||||||
| import glob | ||||||||||||||||
| import os | ||||||||||||||||
|
|
||||||||||||||||
| import yaml | ||||||||||||||||
|
|
||||||||||||||||
| parser = argparse.ArgumentParser() | ||||||||||||||||
| parser.add_argument("-d", required=True) | ||||||||||||||||
| parser.add_argument("--test-names", action="store_true", required=True) | ||||||||||||||||
| parser.add_argument("--output", required=True) | ||||||||||||||||
| args = parser.parse_args() | ||||||||||||||||
| names = set() | ||||||||||||||||
| for path in glob.glob(os.path.join(args.d, "*.yml")): | ||||||||||||||||
| with open(path) as f: | ||||||||||||||||
| for key, blocks in (yaml.safe_load(f) or {}).items(): | ||||||||||||||||
| if isinstance(blocks, list): | ||||||||||||||||
| for block in blocks: | ||||||||||||||||
| names.update(str(t) for t in block.get("tests") or []) | ||||||||||||||||
| with open(args.output, "w") as f: | ||||||||||||||||
| f.write("\n".join(sorted(names)) + "\n") | ||||||||||||||||
| EOF | ||||||||||||||||
| chmod +x "${RUNNER_TEMP}/bin/trt-test-db" | ||||||||||||||||
| echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH" | ||||||||||||||||
|
|
||||||||||||||||
| - name: Run check_test_list | ||||||||||||||||
| env: | ||||||||||||||||
| NVIDIA_TRITON_SERVER_VERSION: '26.09' | ||||||||||||||||
| run: | | ||||||||||||||||
| export LLM_ROOT="$PWD/llm" LLM_BACKEND_ROOT="$PWD/llm/triton_backend" | ||||||||||||||||
| start=$SECONDS | ||||||||||||||||
| # Dependencies were installed by the steps above; skip the script's own | ||||||||||||||||
| # pip install so the measured set is exactly the one under test. | ||||||||||||||||
| python - <<'EOF' | ||||||||||||||||
| import importlib.util | ||||||||||||||||
| import os | ||||||||||||||||
| import sys | ||||||||||||||||
|
|
||||||||||||||||
| path = os.path.join(os.environ["LLM_ROOT"], "scripts", "check_test_list.py") | ||||||||||||||||
| spec = importlib.util.spec_from_file_location("check_test_list", path) | ||||||||||||||||
| module = importlib.util.module_from_spec(spec) | ||||||||||||||||
| spec.loader.exec_module(module) | ||||||||||||||||
| module.install_python_dependencies = lambda llm_src: None | ||||||||||||||||
| sys.argv = [path, "--l0", "--qa", "--waive", "--validate", "--parity", | ||||||||||||||||
| "--check-duplicate-waives"] | ||||||||||||||||
| module.main() | ||||||||||||||||
| EOF | ||||||||||||||||
| echo "COLLECT_SECONDS=$((SECONDS - start))" >> "$GITHUB_ENV" | ||||||||||||||||
|
|
||||||||||||||||
| - name: Summary | ||||||||||||||||
| if: always() | ||||||||||||||||
| run: | | ||||||||||||||||
| { | ||||||||||||||||
| echo "## Collect with full-cuda deps on ubuntu-latest" | ||||||||||||||||
| echo "pip cache restored: ${{ steps.python.outputs.cache-hit }}; size now: $(du -sh "$(python -m pip cache dir)" | cut -f1)" | ||||||||||||||||
| echo | ||||||||||||||||
| echo "| Step | Seconds |" | ||||||||||||||||
| echo "|---|---|" | ||||||||||||||||
| echo "| torch | ${TORCH_SECONDS:-} |" | ||||||||||||||||
| echo "| requirements | ${REQ_SECONDS:-} |" | ||||||||||||||||
| echo "| check_test_list | ${COLLECT_SECONDS:-} |" | ||||||||||||||||
| } | tee -a "$GITHUB_STEP_SUMMARY" | ||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Add a workflow-level
permissionsblock.The workflow has no
permissions:block, so it uses the default token scope. Every job only reads the repository. Several jobs install third-party packages. Restrict the token to read-only access.🔒️ Proposed fix
Based on learnings: jobs that do not push commits, tags, or releases should declare minimal workflow-level permissions such as
contents: read.Committable suggestion
🧰 Tools
🪛 zizmor (1.30.1)
[warning] 25-281: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
Sources: Learnings, Linters/SAST tools